Websense iApp Kerberos Config

I have deployed the Devcentral supplied Websense Content Gateway Assistant iApp to load balance our outbound internet traffic. This all seems to work quite well, but we've noticed that rather than using Kerberos to authenticate the Websense devices are falling back to using NTLM. If we go direct to the appliances it uses Kerberos.

 

The documentation isn't quite clear on this but I suspect that I will need to configure the F5 for Kerberos Delegation. My understanding is that in order to use this we need the Client Authentication module, which we don't have but we have got APM.

 

Can anyone confirm what is required?